From 8cc1d28d6a052ab05e3b186e9f3be00a0d28b93e Mon Sep 17 00:00:00 2001
From: tidy-dev <75402236+tidy-dev@users.noreply.github.com>
Date: Mon, 29 Jun 2026 13:42:55 -0400
Subject: [PATCH] Replace prebuild upload with gh release create for immutable
 releases

- Change permissions from contents: read to contents: write
- Replace yarn upload (prebuild --upload-all) with gh release create --draft
- CI now creates a draft release with assets; human publishes to make it immutable
- Update release docs to reflect new workflow

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/ci.yml |  7 ++++---
 docs/releases.md         | 11 ++++++++---
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d20d7ed..f06f5af 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,7 @@ jobs:
     name: Build
     runs-on: windows-2022
     permissions:
-      contents: read
+      contents: write
     strategy:
       fail-fast: false
       matrix:
@@ -46,6 +46,7 @@ jobs:
         run: npm run prebuild-napi-ia32
       - name: Publish
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
-        run: yarn upload
+        run: |
+          gh release create ${{ github.ref_name }} prebuilds/*.tar.gz --generate-notes --draft
         env:
-          GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/docs/releases.md b/docs/releases.md
index 696191c..0c99d6e 100644
--- a/docs/releases.md
+++ b/docs/releases.md
@@ -8,13 +8,18 @@ of the form `releases/x.x.x`
 After running commands in 'Publishing to NPM', the release branch should be
 pushed. Now, you need to get it reviewed and merged.
 
-After that, don't forget publish the release on the repo.
+After merging, pushing the tag (via `npm publish`) will trigger CI which creates
+a **draft** GitHub release with prebuilt binaries attached. To finalize:
 
 - Go to https://github.com/desktop/registry-js/releases
-- Click click `Draft a New Release`
-- Fill in form
+- Find the draft release created by CI
+- Review that all assets are present (3 `.tar.gz` files)
 - Hit `Publish release`
 
+> **Note:** Publishing the release makes it immutable — assets and the tag can no
+> longer be modified. If something is wrong, delete the draft and cut a new
+> version.
+
 ## Publishing to NPM
 
 Releases are done to NPM, and are currently limited to the core team.